Chapter 5 of 6 · ISC2 CCSP
Cloud Security Operations
Building and running cloud infrastructure, operational standards, ITIL processes, forensics, communication and the SOC.
- 6topics
- 29 minfast track
- 1diagrams and exhibits
- 17%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Building Physical and Logical Cloud InfrastructureCCSP building cloud infrastructure: HSM and TPM settings, secure by default, management plane tools, virtual hardware, hypervisor…5 min
- 2Operating Access, Network and Host SecurityCCSP cloud operations: RDP, SSH, jumpboxes and console access, VLAN, TLS, DHCP, DNSSEC and VPN, firewalls, IDS, IPS, honeypots…5 min
- 3Availability, Monitoring and Backup OperationsCCSP cloud operations: clustered host availability, guest OS availability, performance, capacity and hardware monitoring, backups…5 min
- 4Operational Controls and Service ManagementCCSP operational standards: NIST, ISO, HIPAA, COBIT, CIS, COSO, ITIL and ISO/IEC 20000-1, plus change, release, incident, problem…5 min
- 5Supporting Digital Forensics in the CloudCCSP cloud forensics: data collection methods, evidence management, collecting, acquiring and preserving digital evidence, and…Diagram5 min
- 6Security Operations, Incident Response and CommunicationCCSP security operations: SOC, intelligent monitoring, SIEM and threat intel, incident response, vulnerability tests and talking…4 min
About this chapter
What this chapter covers
Cloud Security Operations is 17% of the ISC2 CCSP exam. It is about the day-to-day work of keeping cloud infrastructure secure and available once it is built: configuring it securely, running and monitoring it, managing change, and responding when something goes wrong.
The domain covers building physical and logical infrastructure with HSMs, TPMs, secure defaults and virtualization settings (5.1), operating and maintaining it through access controls, network security, hardening, patching, availability and monitoring (5.2), implementing operational controls and standards such as ITIL, ISO/IEC 20000-1, NIST, CIS and COBIT (5.3), supporting digital forensics (5.4), managing communication with vendors, customers, partners and regulators (5.5) and managing security operations through the SOC, monitoring, incident response and service management processes (5.6).
Questions put you in the operations seat. Expect to choose the FIRST action in an incident, the BEST way to give administrators secure access, or the service management process that owns a stated problem.
How the topics fit together
Secure builds and hardened operations reduce incidents, standard processes keep change under control, and the SOC detects what still goes wrong. Incident response contains it, forensics explains it, and communication keeps vendors, customers and regulators informed.
In operations questions, uncontrolled change is the usual root cause. When an option fixes a problem by changing production directly, outside change management, look for a better answer that goes through the process.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.